What the assessment week is like

Four things settled in advance

The scope, agreed in writing, so that no morning is lost to a disagreement about what is being examined. The documents, sent when asked and in the format asked for. The people, booked, including somebody from the floor. And the rooms, the access passes and the network arrangements for the assessors.

None of that affects the outcome directly and all of it affects the impression formed in the first hour.

The shape of the week

An opening meeting covering scope, method and logistics. Document review. Interviews with the people who operate the controls. Observation, including walking the floor. A debrief at the end of each day. A closing meeting with the preliminary findings.

The daily debriefs are the part suppliers underuse. They preview what is emerging, and a misunderstanding corrected on Tuesday costs nothing while the same one corrected at the closeout is already in a draft.

Prepare people, do not script them

Tell them what to expect, that questions are about how the work is actually done, and that saying "I do not know, that is Sarah's area" is a good answer rather than a failure.

Scripted answers are audible and they invite a follow-up question the script does not cover. An operator describing what they genuinely do, even where it differs slightly from the procedure, produces a manageable finding; the same operator reciting the procedure and then contradicting it under a second question produces a worse one.

They will walk it

And they will look at what is on benches, what is on screens, where the drawings are, whether the cabinet is locked and what is in the recycling.

The entry on printed media is the preparation for this and the walk usually confirms whatever the paper practices actually are.

Clarify, do not argue

Where an assessor has misunderstood something, explain and provide the evidence. Where they have understood correctly and you disagree with the conclusion, say so once, record it, and move on.

Arguing consumes time you need and changes nothing. Assessors are examining against a standard rather than negotiating.

Where the index pays for itself

A request answered in two minutes from an index, rather than in two hours by a search, changes the pace of the whole week and the number of things that get examined properly.

It also signals an organisation that knows where its records are, which is the impression the assessment is partly forming.

Three recurring problems

A key person unavailable, because the week was booked without them. Evidence that exists and cannot be found. And somebody contradicting the plan, which is the consistency failure the entry on evidence describes.

All three are prevented in the fortnight before rather than during the week.

Elsewhere in getting assessed

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.